search

Reel

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.76.206
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-16 09:29 +08
Nmap scan report for 10.129.76.206
Host is up (0.025s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
25/tcp    open  smtp
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
593/tcp   open  http-rpc-epmap
49159/tcp open  unknown

Interesting ports that are open, as both SMTP and FTP are present.

hashtag
FTP Anonymous Login

This FTP instance allows for anonymous logins:

We can download all of these files here. The readme.txt file tells us that the first step is phishing.

The AppLocker.docx file just states that AppLocker is in place:

The last file cannot be opened for some reason. The most interesting thing about it is the metadata extracted with exiftool:

We have one email here, and it's likely that we need to send our RTF file to nico.

hashtag
CVE-2017-0199 RTF Exploit

This box is quite old and came out back in 2018, so any public exploits used will have to come from around that time. I googled for 'RTF CVE Exploits', and found quite a few. There was one in 2023, but obviously it isn't the intended attack vector.

I came across this article detailing about an RCE exploit in Microsoft Office using RTF files:

LogoAttack Signature Detail PageBroadcomchevron-right

Googling for PoCs for this exploit leads me to this somewhat popular repository:

LogoGitHub - bhdresh/CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other payload to victim without any complex configuration.GitHubchevron-right

Following the instructions, we can first generate a payload using msfvenom. Earlier, we saw that AppLocker is in place for most executables and scripts, and this exploit allows multiple other methods of getting RCE, such as generating a hta file.

We can host this file on our own Python HTTP server. Then, generate the RTF file required:

Afterwards, we just need to use sendEmail with the file attached.

I tried this a few times, and it seems to only work when we use the -x 0 flag instead. When changed, we can get a reverse shell as the user:

hashtag
Privilege Escalation

hashtag
Tom Creds

Within the user's directory, there's a cred.xml file present:

When viewed, it contains credentials for the tom user:

Since this is a Powershell generated XML file, we can use the Import-Clixml cmdlet to decode it.

Using this password, we can ssh in as tom.

hashtag
Bloodhound -> WriteOwner

The user tom is part of multiple AD groups:

The desktop also contains some interesting files:

So there's already a csv file present with the ACLs we need. I transferred file back to my machine via smbserver.py, and opened it in libreoffice. Then, I searched for the user tom to see if they had any permissions.

I found that our current user has WriteOwner permissions over the user claire.

This would mean that tom can add permissions over claire, of which we don't have any yet. To abuse this, we first need to set tom as the owner of the ACLs over claire using PowerView.

Oddly, there's a copy of PowerView on the machine already:

I originally tried copying over my own copy and executing it, but AppLocker kept blocking me. However, using the already present script works. We can then abuse this ACL by setting tom as the object owner and changing passwords of claire:

Afterwards, we can ssh in as claire using this password.

hashtag
WriteDacl -> Admin Creds

The user claire is part of another group.

Checking back on the Bloodhound output, we see that claire has WriteDacl permissions over the Backup Admins group:

This means that the user claire can modify the ACLs of the group, which includes adding and removing users.

We can then check the ACLs of the C:\users\administrator directory:

We can view the files present in the Desktop, but we cannot read the root flag.

The Backup Scripts folder contains some interesting files, and one contains the admin password:

We can then login as the administrator user:

Rooted!

PreviousRainyDayNextRegistry

Last updated